GROUP BUSINESS CONTINUITY MANAGEMENT POLICY

Transcription

1 GROUP BUSINESS CONTINUITY MANAGEMENT POLICY POLICY IMPLEMENTATION CHECKLIST Policy Guardian: Business Services Director Author: Business Services Director Version number: 4 Approved by Chief Executive on: 1 February 2015 Approved by Management Board on: 24 February 2015 Effective from: 24 February 2015 Date of Last Review: February 2018 Date of Next Review: 1 February 2020 Diversity compliant: Equality Impact Assessment required: No Data Protection compliant: Health & Safety compliant: N/A Procedure implemented: QL system changes made: N/A KPIs / reporting arrangements implemented: Training Completed: Posted on intranet: 25 February 2015 Posted on website: 25 February 2015 Publicity material issued: Business Services Implementation Review: 31 March 2015 This document can also be provided in large print, braille, audio or other non-written format, and in a variety of languages

2 1. Overview The Caledonia Housing Association Group ( the Group ) is made up of Caledonia Housing Association, and its constitutional partners, Cordale Housing Association, and Bellsmyre Housing Association. The Group is fully committed to ensuring its internal processes are sufficiently robust that key services continue to be delivered during any significant incident. This commitment is achieved through developing appropriate business continuity management arrangements across the Group. Business continuity management is a framework that assists in the management of risks which might impact the smooth running of an organisation or the delivery of a service. These risks could be from the external environment such as adverse weather, utilityrelated or disruption caused by the loss of a key supplier. In terms of internal disruption this could be caused by the loss of key staff, ICT systems failure or the loss of offices/business premises. Business continuity management provides a framework for improving resilience to interruption so that key business systems and processes can be recovered while at the same time ensuring the provision of business-critical services to service-users. 2. Aims and Objectives of Caledonia Business Continuity Policy The aim of this policy is to set out the requirements and approach for the production of a Business Continuity Management Plan (BCMP) for all identified business-critical activities. The BCMP will ensure there are sufficient levels of resilience within the Group s business-critical activities. Having developed the necessary resilience levels into those key activities, customers will receive the appropriate level of service provision during an emergency/disaster. The objectives of this policy are: I. To improve the resilience of each department within the Group through identifying and managing their many and varied operational risks inherent in the delivery of their services; II. To efficiently maximise the use of key Group resources during an emergency/disaster; III. Commit the Group to regular reviews of the business continuity arrangements/plans to ensure they reflect the operational needs of the Group. 3. Policy Scope The scope of this policy covers business-critical activities delivered to Group internal customers (internal and external), and service delivery partners which includes (but not limited to): Tenants/service-users across all three associations Group staff Contractors Partnership bodies 2

3 4. Links to Other Caledonia Housing Group Policies/Procedures This policy is linked to the following Group policies and procedures which have business continuity considerations: Group Risk Management Policy Emergency Response Procedure Notifiable Events Policy and Procedure Group Data Protection Policy 5. Business Continuity Management Plan Implementation The Group s Business Continuity Management Plan (BCMP) will only be implemented in the event of a disaster. The Group has defined a disaster as: A business interruption event that is extraordinary and that causes disruption to, or loss of key business resources Examples of common disasters falling under the above description include the following: Loss of key business premises/offices through major damage or restricted access to buildings; Adverse weather conditions preventing staff from attending their workplace; Loss of key Group ICT systems; Significant data/information breach due to internal service failure or from a cyber security breach; Loss of key staff through widespread illness or strike action; Loss of life through fire or serious accident in the workplace; and Major utility failure or key suppliers/contractors unable to provide businesscritical services to the Group. The object of the BCMP is to ensure that appropriate structures and protocols are in place to enable effective response to a business interruption event that has the potential to impact on the Group s objectives. The Group s BCMP documents the processes and resources required to deliver the critical services required by the Group s many service-users/customers. In identifying the business-critical activities within the Group, the focus is on building of the resilience and response capabilities that have been identified as critical to service delivery. The Group s BCMP will manage and develop resilience levels for all the identified business critical-activities within the Group. 6. Roles & Responsibilities The overall responsibility for the BCMP is with the Group s Chief Executive Officer. The Chief will ensure in situations where the BCMP is invoked, that all departments work together to restore business-critical services. To support the Chief Executive Officer in their business continuity role, the Group has developed an emergency response procedure to manage the initial response in any emergency/disaster situation. 3

4 The responsibility for maintaining, and ensuring the Group s BCMP remains effective in response to any disaster situation has been devolved to the Group s Business Continuity Management Project Team (BCMPT). The BCMPT consists of representatives from each department within the Group, (including a representation for the partnership Associations). All BCMPT representatives have in-depth knowledge relating to the business-critical activities within their respective departments. 7. Recovery Following completion of the immediate response phase and management of the incident as detailed in the Group s Emergency Response procedure, the strategic role for recovery and resumption is shared between the following: i. Emergency Lead Officer ii. Service Recovery Team Co-ordination and direction at departmental level will be provided by departmental management team using the relevant elements of the Group BCMP. The BCMP will be used flexibly to inform the response according to the scope and magnitude of the disruption. The process for restoration of critical services will be based on the Business Recovery Plans contained in the Group s BCMP. Each Business Recovery Plan will provide the necessary information/guidance to restore the agreed level of business-critical activities. 8. Incident Reporting & Media Management A disaster or business continuity incident often creates significant interest from the local and national media. Therefore it is essential that only authorised Group staff can act as the nominated spokesperson for the Group. In most cases the Chief Executive will be the only point of contact with the media and will inform the Chair or Vice Chair of the disaster/business continuity incident. In the absence of the Chief Executive, the Emergency Lead Officer will have delegated authority to deal with media enquiries and authority to contact the Chair or Vice Chair. The Chief Executive Officer may delegate responsibility to the Area Director for the following in regards to a business continuity event that involves any of the partnership Associations: Media management Notifying the respective Chair of the governing body regarding the The Emergency Lead Officer has also delegated authority to contact the Scottish Housing Regulator (SHR) in relation to reporting the incident if it falls within the SHR s definition of a notifiable event. Details of any disaster/business continuity event will also be reported to the Management Board at the next appropriate Board Meeting. Any business continuity incident involving the partnership Associations will be jointly reported to both the Group Management Board, and the respective partnership Association governing body. 4

5 9. Review and Testing of Business Continuity Plan To ensure the BCMP remains robust and effective in terms of restoration of businesscritical activities, the Group will review the plans every six-months. The Group will develop a programme of testing and exercising of the BCMP. Any lessons learned from the testing of the BCMP will be incorporated into the rolling sixmonthly review process as part of the Group s commitment to continuous improvement. 10. Group Governance Arrangements Business Continuity Management forms part of the Group s overall corporate governance arrangements. An annual report will be submitted to the Group s Management Board providing details on the following: Any incidents that required the Group s business continuity arrangements to be implemented by the Chief Executive Officer; Details of any implications/obligations arising from new legislation relating to business continuity management within the registered social housing sector; Any key findings from the testing/validation programme relating to the Group BCMP; and Any recommendations arising from internal or external audits of the Group s business continuity arrangements. 11. Policy Availability This policy will be available on the Group s internet and intranet. This policy will be provided to all key suppliers/contractors who have a business continuity role within the restoration of the Group s business-critical activities. 5